Hardware Backdooring An eScooter

Hardware Backdooring An eScooter

Speakers: Arun Mane, Founder and CEO of Amynasec Research Lab, Co-founder for Uno Academy

Conference: HITB Phuket

YouTube: https://www.youtube.com/watch?v=Uj44hhZsEPI

Overview

In his compelling talk at HITB Phuket, Arun Mane of Amynasec Labs unveiled critical cybersecurity vulnerabilities within modern electric scooters, demonstrating how a simple, inexpensive hardware implant can enable remote control and even arbitrary shutdown of these increasingly popular vehicles. Drawing parallels with high-profile automotive hacks, Mane highlighted the burgeoning e-scooter market, particularly in India where electric two-wheelers are projected to reach 10 million units by 2030. Despite their advanced features like live tracking, geo-fencing, and navigation, e-scooters currently lack fundamental cybersecurity safeguards, leaving them susceptible to attacks that could have severe safety implications for riders.

The presentation served as a stark warning to manufacturers and consumers alike, debunking the myth that e-scooters are inherently secure. Mane detailed the process of reverse engineering a scooter's internal communication protocols, identifying critical messages that govern essential functions, and ultimately weaponizing this knowledge to create a remote backdoor. The research underscores an urgent need for the integration of robust cybersecurity measures into e-scooter design and manufacturing, moving beyond mere functional safety to encompass comprehensive protection against malicious exploitation.

Background

▶ Watch: Introduction: Why e-scooters are a growing attack surface (0:00)

The inspiration for this research stems from the automotive industry's past encounters with vehicle hacking, notably the 2015 Jeep Cherokee remote compromise by Charlie Miller and Chris Valasek, and more recent vulnerabilities exposed in Kia and Hyundai vehicles via mobile applications. These incidents demonstrated the severe risks associated with connected vehicles and their complex electronic architectures. As electric scooters rapidly evolve to incorporate similar advanced features—such as GPS, GSM connectivity, Bluetooth, and sophisticated infotainment systems—they inherit many of the same security challenges, often without the benefit of mature cybersecurity standards or defensive architectures present in some modern cars.

The architecture of e-scooters varies, ranging from single ECU (Electronic Control Unit) systems, where a sole Vehicle Control Unit (VCU) manages all critical functions (temperature, stand, battery management, speed, fuel, gyro sensors), to multiple ECU systems found in more advanced models. These multi-ECU configurations often include dedicated infotainment systems running operating systems like Android or modified Linux, integrated GPS/GSM modules (using e-SIMs or physical cards), and Bluetooth capabilities. Communication between these ECUs, and indeed across the entire vehicle, primarily relies on the CAN (Controller Area Network) bus protocol. The CAN bus operates as a two-wire communication system (CAN high and CAN low) where ECUs broadcast messages, and all other ECUs listen, reacting to relevant data. Key components include a message's arbitration ID (11 or 29-bit), Data Link Control (DLC), data field, Cyclic Redundancy Check (CRC), and End of Frame. The timing between consecutive messages is crucial, with high-priority messages (e.g., braking, engine start/stop) typically transmitting at 250 milliseconds, distinguishing them from lower-priority messages at 500 milliseconds or 1 second intervals. This prioritization is fundamental to the safety standards (like ISO 26262) governing automotive systems, which increasingly integrate cybersecurity considerations.

For initial reconnaissance, researchers utilize tools such as USBtin (an affordable USB-to-CAN interface costing around $35), Peak CAN (a more robust option at $250-$300), or more expensive commercial solutions like those from Intrepid. The process of CAN bus reverse engineering involves physically accessing the scooter's wiring harness to identify the CAN high and CAN low wires. Once connected, software tools like CAN bus utilities or can-utils on Linux are employed to intercept and log all network traffic. The crucial next step is to correlate specific CAN messages with physical events. For instance, pressing the brake pedal, turning the ignition, or accelerating the motor will generate distinct message patterns on the bus, allowing researchers to identify which message IDs correspond to which vehicle functions. This methodical approach forms the bedrock for understanding the vehicle's internal logic and subsequently identifying potential points of attack.

Key Findings

▶ Watch: Understanding CAN bus communication and message priorities (6:15)

Arun Mane's research successfully demonstrated that critical safety and operational messages within the e-scooter's CAN bus communication are vulnerable to various forms of manipulation. By reverse engineering the CAN bus, the team identified a range of messages that, if tampered with, could trigger severe adverse effects on the vehicle's functionality. While specific message IDs and OEM details were withheld due to a proactive disclosure to the manufacturer and subsequent rectification, the categories of vulnerable messages and the attack vectors employed were clearly outlined.

The primary types of attacks performed included:

• Replay Attacks: Recording legitimate CAN bus messages and re-sending them to trick the ECUs into repeating previous actions or states.
• Forge CAN Bus Injection: Modifying the data within CAN messages or crafting entirely new messages to inject into the bus, leading to abnormal vehicle behavior.
• Fuzzing: Systematically testing various arbitration IDs by sending random or malformed data to discover undocumented commands or trigger unexpected responses.
• Denial-of-Service (DoS) Attacks: Overwhelming the CAN bus with a flood of messages, causing a communication jam that can disrupt infotainment systems and even halt critical vehicle functions.
• Bus Off Attacks: Exploiting inherent error handling mechanisms within the CAN bus standard. By intentionally generating specific error conditions, an attacker can force ECUs into a "bus off" state, effectively isolating them from the network and stopping all communication across the bus. This leverages an implementation flaw that, while intended for error recovery, can be weaponized.
• Error Passive Spoof Attacks: Manipulating the CAN bus error state to interfere with communication without necessarily causing a full bus-off, potentially leading to intermittent or targeted disruption.

Through these attack methodologies, the research team identified several critical messages. For example, spoofing a "battery low" message could prevent the motor from starting, a mechanism intended for battery protection but exploitable to disable the vehicle. Similarly, repeatedly sending an "off vehicles" message could forcibly turn down the motor and shut off the entire scooter. Other messages were found to trigger immediate engine kills, displaying "scooter issue going on to halt" messages, or abruptly turning off the motor while the vehicle was in motion. These findings underscore a fundamental lack of validation and authentication for critical messages on the CAN bus, allowing an attacker with physical or remote access to dictate the scooter's behavior.

Technical Deep Dive

▶ Watch: Demonstration of specific CAN bus attack effects (17:55)

The technical core of this research lies in the meticulous process of CAN bus reverse engineering and the subsequent exploitation of identified messages. The initial phase involved gaining physical access to the target e-scooter's wiring harness to locate the CAN high and CAN low wires. This often requires disassembling parts of the vehicle, such as the front panel, to expose the internal cabling. Once identified, a CAN bus analyzer (like a USBtin or Peak CAN device) was connected to these wires, allowing a laptop running can-utils or similar software to log all traffic on the bus.

The crucial step of message correlation then began. By performing specific actions on the scooter—such as engaging the brakes, twisting the throttle, toggling lights, or initiating a startup sequence—the researchers observed corresponding message patterns in the logged CAN data. For instance, pressing the brake would cause a specific arbitration ID with particular data bytes to appear consistently. This allowed them to map physical events to their digital representations on the CAN bus. The speaker emphasized the importance of message timing, noting that high-priority messages (e.g., related to braking or engine state) are often transmitted at 250ms intervals, making them easier to distinguish and prioritize for attack.

Once critical messages were identified, various attack vectors were explored:

• Replay attacks are straightforward: a recorded message (e.g., "turn on headlight") is simply retransmitted to trigger the associated function.
• Forged message injection involves altering the data payload of an existing message or crafting a new one. For example, if a message typically indicates speed, modifying its data bytes could potentially spoof a different speed reading or trigger an unexpected motor response.
• Fuzzing arbitration IDs is a discovery technique. By sending messages with arbitrary or sequentially generated arbitration IDs, attackers can probe the network for ECUs that might respond to undocumented or unexpected commands. This can reveal hidden functionalities or crash vulnerable ECUs.

More sophisticated attacks leveraged specific characteristics of the CAN bus protocol:

• DoS attacks exploit the shared nature of the CAN bus. By flooding the bus with high volumes of messages, an attacker can consume the available bandwidth, preventing legitimate messages from being transmitted or received by ECUs. This can lead to a complete communication breakdown, effectively jamming the entire vehicle's network and rendering it unresponsive.
• The Bus Off attack is particularly potent. The CAN standard includes error detection and fault confinement mechanisms. If an ECU detects too many errors, it can transition into an "error passive" state, and if errors persist, it can go "bus off," effectively disconnecting itself from the network to prevent it from corrupting further communication. Attackers can deliberately trigger these error conditions (e.g., by sending malformed messages or rapidly transmitting conflicting messages) to force critical ECUs into a bus off state, thereby shutting down essential vehicle functions. The speaker highlighted this as an "implementation flaw" from a hacker's perspective, even if automotive engineers view it as a safety feature.

Specific examples of identified message impacts, though anonymized, included:

• A "battery low" message, when spoofed, could prevent the motor from starting. While intended as a safety feature, its lack of authentication allowed an attacker to disable the vehicle.
• Repeatedly sending an "off vehicles" message could force the motor to power down and turn off the entire vehicle.
• Another message, when injected, would display "scooter issue going on onto halt" and kill the engine.
• A specific modification to a message could cause the motor to abruptly turn off, even while in motion.

These findings demonstrated that the e-scooter's CAN bus, in its current implementation, functions as a trusting network where any message injected by an authorized or unauthorized source is accepted and acted upon, without robust authentication or integrity checks. This fundamental design flaw forms the basis of the demonstrated remote control capabilities.

Demo / Proof of Concept

▶ Watch: Hardware implant setup: components and low cost (19:55)

The most impactful part of the talk was the demonstration of a hardware implant attack, showcasing how an attacker could gain remote control over an e-scooter. The implant itself was remarkably simple and cost-effective, designed to blend seamlessly into the vehicle's existing electronics.

The core components of the hardware implant included:

• An Arduino microcontroller.
• An ESP32 module, providing Wi-Fi connectivity for remote control.
• An MCP2551 CAN transceiver chipset, which acts as the interface between the Arduino/ESP32 and the scooter's CAN bus, translating logical signals into CAN bus-compatible electrical signals and vice-versa.

The entire setup was powered by the scooter's existing USB port, which typically provides 5V, and supplemented by a small power bank for sustained operation. Mane highlighted the low cost of the components, estimating the total expense at approximately $15, with the potential to reduce it further to $5 through optimization and component selection. The implant was discreetly placed inside the scooter's front panel, making it difficult for an average user to detect. Remote control was achieved via a custom interface utilizing MQTT (Message Queuing Telemetry Transport), a lightweight messaging protocol suitable for IoT devices, which communicated with an online server.

Two compelling demonstrations were presented:

1. Stopping a moving scooter: In a controlled lab environment, Mane demonstrated driving the scooter. While in motion, the remote attack was initiated. The immediate effect was the headlight turning off and the acceleration ceasing, effectively killing the engine and bringing the scooter to a halt. This live demonstration underscored the severe safety implications, as such an event on a public road, especially a highway, could lead to catastrophic accidents.
2. Shutting down a stationary scooter: A second demonstration showed the implant's ability to completely shut down a stationary scooter. Upon receiving the malicious command, the entire scooter powered off. The infotainment system then initiated a restart sequence, displaying boot-up lines and subsequently prompting for a passcode, indicating a full system reboot triggered by the attack. This illustrated how an attacker could render a scooter inoperable or force a user to re-authenticate, potentially facilitating theft or further compromise.

The speaker also briefly touched upon the possibility of external attacks without physical access, mentioning techniques like using fake BTS (Base Transceiver Station) or fake eNodeB (evolved Node B) to inject data over cellular networks. While not demonstrated in detail during this specific talk, it suggests a broader scope of potential vulnerabilities beyond direct hardware implants, further emphasizing the need for robust security at all layers of the e-scooter's connected architecture. The lack of gateways in most e-scooters, unlike advanced smart cars which use them as "firewalls" between different network segments, was identified as a critical factor enabling these widespread attacks.

Defensive Implications

▶ Watch: Conclusion: E-scooter security is a myth; need for standards (27:30)

The research unequivocally demonstrates that the prevailing assumption of e-scooter security is a dangerous myth. The findings highlight several critical areas where manufacturers must urgently improve their cybersecurity posture to protect riders and prevent widespread exploitation.

1. Lack of Network Segmentation and Gateways: A primary vulnerability identified is the absence of gateways in current e-scooter designs. In modern smart cars, gateways act as firewalls, segmenting the vehicle's network and controlling communication between different ECUs and external interfaces. This prevents a compromise in one less critical system (e.g., infotainment) from directly affecting safety-critical systems (e.g., braking, motor control). E-scooters, largely driven by cost considerations, typically lack such segmentation, meaning a single point of entry or a compromised CAN bus message can impact the entire vehicle. Manufacturers must integrate secure gateways to enforce strict access control and message validation between ECUs.

1. Inadequate Message Authentication and Integrity: The core of the attacks relies on the CAN bus's trusting nature, where messages are accepted and acted upon without sufficient authentication or integrity checks. Defenders need to implement robust cryptographic mechanisms to ensure that only authenticated and authorized ECUs can send critical commands. This includes techniques like Message Authentication Codes (MACs) or digital signatures for safety-critical messages, preventing replay, spoofing, and forging attacks.

1. Need for Intrusion Detection Systems (IDS): Just as enterprise networks employ IDS to detect malicious activity, e-scooters require similar capabilities. An Intrusion Detection System (IDS) for the CAN bus could monitor message patterns, timing, and content for anomalies that indicate an ongoing attack (e.g., unexpected message floods, invalid arbitration IDs, or out-of-sequence critical commands). Early detection can enable defensive actions, such as isolating a compromised ECU or alerting the rider.

1. Integration of Cybersecurity into Design Standards: The speaker emphasized that while manufacturers focus on functional safety (e.g., mechanical brakes as a backup), they often overlook cybersecurity. Cybersecurity must be integrated from the earliest stages of design, adhering to standards like ISO 21434 (Road vehicles – Cybersecurity engineering), which provides a framework for managing cybersecurity risks throughout the vehicle's lifecycle. This means conducting thorough threat modeling, risk assessments, and security testing.

1. Engagement of External Automotive Cybersecurity Experts: Internal development teams may lack the specialized expertise required to identify and mitigate complex automotive cybersecurity vulnerabilities. Manufacturers should proactively engage external automotive cybersecurity experts to conduct independent penetration testing, vulnerability assessments, and design reviews. This outside perspective is crucial for uncovering blind spots and ensuring comprehensive security.

1. Addressing the "E-scooters are Secure" Myth: The industry and consumers must abandon the misconception that e-scooters, due to their smaller size or perceived simplicity, are inherently secure. As they become "smarter" and more connected, they become increasingly attractive targets for malicious actors. Public awareness campaigns and transparent security disclosures are necessary to inform users of the risks.

In summary, the defensive implications call for a paradigm shift from purely functional safety to a holistic approach that embeds cybersecurity deeply into the entire e-scooter ecosystem. Without these measures, the convenience and environmental benefits of e-scooters will continue to be overshadowed by significant safety and security risks.

Key Takeaways

• E-scooters are Highly Vulnerable: Despite increasing sophistication and features, current e-scooters lack fundamental cybersecurity protections, making them susceptible to remote control and critical function manipulation.
• CAN Bus is the Primary Attack Surface: The CAN bus, a core communication protocol in e-scooters, operates without robust authentication, allowing attackers to inject, replay, or forge messages to control vehicle functions like motor kill, braking, and infotainment.
• Inexpensive Hardware Implants Enable Remote Control: A simple, sub-$15 hardware setup (Arduino, ESP32, CAN transceiver) can be discreetly installed to gain remote control over a scooter via Wi-Fi/MQTT, demonstrating a low barrier to entry for attackers.
• Safety-Critical Functions Are at Risk: Attacks can abruptly stop a moving scooter, shut down the engine, or render the vehicle inoperable, posing severe safety risks to riders, especially on public roads.
• Urgent Need for Cybersecurity Integration: Manufacturers must integrate cybersecurity into e-scooter design standards, implement secure gateways, message authentication, and Intrusion Detection Systems (IDS), and engage external security experts to mitigate these threats.
• The "Secure E-scooter" is a Myth: The perception that e-scooters are inherently secure is false; as the market rapidly expands, addressing these vulnerabilities is critical for user safety and industry reputation.

About the Speaker(s)

Arun Mane is a distinguished serial entrepreneur, researcher, and trainer in the field of cybersecurity. He is the founder and CEO of Amynasec Research Lab, an organization dedicated to advanced security research. Additionally, he is a co-founder of Uno Academy. Mane specializes in hardware hacking, vehicle security, IOMT (Internet of Medical Things), IoT (Internet of Things), and industrial control systems (ICS). He is a prolific speaker at numerous cybersecurity conferences globally, sharing his expertise and insights into emerging threats. His work emphasizes practical, hands-on approaches to identifying and mitigating complex vulnerabilities in connected systems.